The internet is on high alert after the discovery of eight compromised TLS certificates linked to a critical vulnerability in the OpenSSL cryptography library. Known as Heartbleed, the flaw enabled hackers to decrypt protected exchanges, steal private keys, session cookies, and passwords. The attacks affected thousands of servers, including those of major corporations and government agencies. Recovery was a years-long process involving patching OpenSSL, reissuing millions of TLS keys, revoking certificates, rotating passwords, and updating embedded systems.
The compromised keys from eMudhra were defective at an extreme level. While a standard NIST P-384 private key contains 384 bits of entropy, these keys ranged from just 3 to 8 bits. Engineers found keys with entropy values of 4, 56, 66, 115, 155, 156, 230, and 237 bits—far below acceptable security thresholds.
"This should not be possible," said Valsorda, suggesting a dangerous key generation interface may have had its size parameter mistakenly set to 1. Ben Cartwright-Cox of BGP.tools speculated that example code may have accidentally leaked into production, calling the oversight "bonkers." The incident highlights ongoing risks in cryptographic implementation and system oversight.
Source: Ars Technica · Summarized by HeadlinesBriefing